problem with ZopeFind and objectValues
Hi, please could someone explain me why when accessing the same zope site anonymously: <dtml-in "objectValues(['Folder'])"> <dtml-var id> - <dtml-var title> </dtml-in> works as expected and displays a list of id and titles of the current folder's subfolders, but <dtml-in "ZopeFind(this(), obj_metatypes=['Folder'])"> <dtml-var id> - <dtml-var title> </dtml-in> gives me the following error: """Unauthorized You are not authorized to access id.""" If I set a proxy role of manager to this dtml-method that doesn't change anything, it still doesn't work. If I log in as superuser both work the same (Zope 2.1.6). In fact I want to do a ZopeFind with search_sub set to 1 to recurse all subfolders from the current one. Is there any other method to do it, or should I set a particular parameter to a particular value (not found how to really use ZopeFind in ZQR, the sample is far too short IMHO). How can I restrict a search in Zcatalog to the current folder and its subfolders ? Jerome ALET - alet@unice.fr - http://cortex.unice.fr/~jerome Faculte de Medecine de Nice - http://noe.unice.fr - Tel: 04 93 37 76 30 28 Avenue de Valombrose - 06107 NICE Cedex 2 - FRANCE
I can now answer in part: On Mon, 3 Jul 2000, Jerome Alet wrote:
<dtml-in "ZopeFind(this(), obj_metatypes=['Folder'])"> <dtml-var id> - <dtml-var title> </dtml-in>
gives me the following error:
"""Unauthorized
You are not authorized to access id."""
If I set a proxy role of manager to this dtml-method that doesn't change anything, it still doesn't work.
In fact if I give this method a proxy role of Manager then it works fine if I access directly to this method from my browser. However if I call this method from inside another dtml method then it seems that the method loose its proxy role of manager. e.g.: say mymethod has a proxy role of manager and a method called anothermethod contains somewhere: <dtml-var mymethod> then if anothermethod has no proxy role at all: browsing: http://myserver/myfolder/mymethod works fine. browsing: http://myserver/myfolder/anothermethod doesn't work (Unauthorized). I have to give the proxy role of Manager to anothermethod too if I want both to work correctly. Is it a feature or a bug ? thanks in advance. Jerome ALET - alet@unice.fr - http://cortex.unice.fr/~jerome Faculte de Medecine de Nice - http://noe.unice.fr - Tel: 04 93 37 76 30 28 Avenue de Valombrose - 06107 NICE Cedex 2 - FRANCE
On Tue, 4 Jul 2000, Jerome Alet wrote:
In fact if I give this method a proxy role of Manager then it works fine if I access directly to this method from my browser. However if I call this method from inside another dtml method then it seems that the method loose its proxy role of manager. [....] Is it a feature or a bug ?
I'm 90% sure it's a feature, but I forget at the moment why. I suspect the reasoning is in the security Wiki somewhere. --RDM
participants (2)
-
Jerome Alet -
R. David Murray